@desplega.ai/agent-swarm 1.173.0 → 2.1.0

package/src/providers/pi-mono-extension.ts

@@ -653,9 +653,22 @@ export function createSwarmHooksExtension(config: SwarmHooksConfig): ExtensionFa
     // === session_compact → PreCompact ===
     // Re-anchor the model on its task once compaction has summarized the
     // history. `context` fires before every LLM call, so it cannot carry this.
-    pi.on("session_compact", async () => {
+    pi.on("session_compact", async (event, ctx) => {
       if (!config.taskId) return;
 
+      // The one real compaction signal: shaped like the claude runner's rows.
+      fireAndForget(`${config.apiUrl}/api/tasks/${config.taskId}/context`, {
+        method: "POST",
+        headers: apiHeaders(config),
+        body: JSON.stringify({
+          eventType: "compaction",
+          sessionId: `pi-${config.taskId}`,
+          compactTrigger: event.reason === "manual" ? "manual" : "auto",
+          preCompactTokens: event.compactionEntry?.tokensBefore,
+          contextTotalTokens: ctx.getContextUsage?.()?.contextWindow,
+        }),
+      });
+
       const taskDetails = await fetchTaskDetails(config);
       if (taskDetails) {
         const reminder = await renderGoalReminder(taskDetails);
@@ -667,14 +680,15 @@ export function createSwarmHooksExtension(config: SwarmHooksConfig): ExtensionFa
     pi.on("context", async (_event, ctx) => {
       if (!config.taskId) return undefined;
 
-      // Report context usage as a compaction event
+      // Per-call usage snapshot: "progress", as the claude/codex runner posts
+      // per-turn usage. Only session_compact reports a compaction.
       const usage = ctx.getContextUsage?.();
       if (usage) {
         fireAndForget(`${config.apiUrl}/api/tasks/${config.taskId}/context`, {
           method: "POST",
           headers: apiHeaders(config),
           body: JSON.stringify({
-            eventType: "compaction",
+            eventType: "progress",
             sessionId: `pi-${config.taskId}`,
             contextUsedTokens: usage.tokens ?? undefined,
             contextTotalTokens: usage.contextWindow,

package/src/providers/pricing-sources.md

@@ -22,8 +22,8 @@ rate by hand should also update this file.
 - **Runtime module**: `src/be/models-catalog.ts`; route in
   `src/http/models-catalog.ts`.
 - Every successful models.dev fetch in the runtime refresh above also updates
-  an in-memory slim catalog (openrouter / anthropic / openai / amazon-bedrock
-  only, picker-relevant fields only). The UI model picker
+  an in-memory slim catalog (openrouter / anthropic / openai / amazon-bedrock /
+  nan / helmcode only, picker-relevant fields only). The UI model picker
   (`apps/ui/src/lib/agent-runtime-models.ts` via `useModelsCatalog()`) prefers
   this over its build-time snapshot, so new models appear without a deploy.
 - Pinned limited-availability entries (`PINNED_MODELSDEV_ENTRIES`) are
@@ -84,6 +84,25 @@ rate by hand should also update this file.
     `inputTokens`, clamped to zero, so fresh input is priced separately.
     Cursor's own models are not in models.dev: see
     `CURSOR_FIRST_PARTY_PRICING` below.
+  - OpenAI-compatible registry providers: NaN models (models.dev `nan`
+    section) and Helmcode models (the registry-synthesized `helmcode`
+    section, below) → rows under `provider='pi'` and
+    `provider='opencode'`, keyed `nan/<id>` and `helmcode/<id>`, at $0 input
+    and $0 output. Both providers bill a flat rate per key, so a session's
+    marginal cost is $0. `buildModelsDevSeedRows()` projects them, so the rows
+    land at boot seed and on refresh, and sessions record $0 with
+    `costSource: "pricing-table"` rather than `unpriced`.
+
+- **Registry-synthesized `helmcode` section**: Helmcode is not on models.dev.
+  Its five agent models (`deepseek-v4-flash`, `glm5.3`, `glm5.3-flash`,
+  `qwen3.6`, `gemma4`) live in the provider registry
+  (`packages/model-catalog/src/openai-compatible-providers.ts`,
+  `catalog: "registry"`). `withRegistryCatalogSections` adds the section,
+  at $0, to the snapshot loader (`loadModelsDevCache`), the worker runtime
+  catalog and the dashboard bundle, and the live catalog refills it
+  (`setLiveModelsCatalog`). Model limits are copied from Helmcode's own
+  opencode and pi config pages. Helmcode's resold Claude, GPT and Gemini
+  models are not included.
 
 - **Snapshot refresh procedure**:
   - Run `bun run scripts/refresh-modelsdev-pricing.ts` (Phase 2 — adds the
@@ -167,6 +186,18 @@ and heartbeat-classified roots are omitted, and the metrics remain separate.
   scheduled increase to $3/M input and $15/M output on 2026-09-01. Claude
   Code's bundled local rate table may be stale-high, so treat its reported USD
   as advisory and use the server-recomputed row for the canonical total.
+- **Claude 5.5 cache reads:** Opus 5.5 and Sonnet 5.5 cache hits cost 0.05x
+  input ($0.20/M and $0.10/M), not the usual 0.1x. Claude Code builds in use
+  around 2026-10-09 still priced Sonnet 5.5 hits at $0.20/M, so their
+  `harnessCostUsd` runs high by `cacheReadTokens × $0.10/M`.
+- **Claude Haiku 5.5 context tier:** a request whose prompt (input + cache
+  reads + cache writes) is over 100k tokens bills every class at 5x: $0.50/M
+  input, $0.05/M cache hit, $0.625/M 5m write, $1/M 1h write, $2.50/M output.
+  It is the only Claude 5.x model with a long-context tier; the others bill the
+  full 1M window at standard rates. The recompute prices Haiku 5.5 at the base
+  tier, so sessions with over-100k requests under-count, and the harness total
+  is the closer figure for them. Same per-request accounting gap as GPT-5.6
+  below.
 - **GPT-5.6 context tier:** above 272k context, the GPT-5.6 family bills
   2× input/cache rates and 1.5× output rates. The current recompute receives
   aggregate session token counts, not enough per-request context information

package/src/providers/reasoning-effort.ts

@@ -245,3 +245,40 @@ export function applyReasoningEffort(
     }
   }
 }
+
+const REASONING_HARNESSES: ReadonlySet<string> = new Set<ReasoningHarness>([
+  "claude",
+  "codex",
+  "pi",
+  "opencode",
+  "dsh",
+  "cursor",
+  "amp",
+  "grok",
+]);
+
+/**
+ * The levels a session on this harness and model accepts; empty for a harness
+ * this feature does not cover. Unlike `effectiveReasoningEffort`, a supported
+ * level with no transport effect (Opencode `off`) is still listed.
+ */
+export function supportedReasoningLevels(harness: string, model: string): ReasoningEffort[] {
+  if (!REASONING_HARNESSES.has(harness)) return [];
+  return reasoningCapability(harness as ReasoningHarness, model).levels;
+}
+
+/**
+ * The effort a session on this harness and model actually runs at: `level`
+ * when the adapter applies it, null when it is unset or dropped (the harness
+ * default applies). Same decision the adapters make in `applyReasoningEffort`.
+ */
+export function effectiveReasoningEffort(
+  harness: string,
+  model: string,
+  level: ReasoningEffort | undefined,
+): ReasoningEffort | null {
+  if (!level || !REASONING_HARNESSES.has(harness)) return null;
+  return applyReasoningEffort(harness as ReasoningHarness, model, level).kind === "noop"
+    ? null
+    : level;
+}

package/src/providers/types.ts

@@ -33,7 +33,11 @@ export interface CostData {
   cacheWrite1hTokens?: number;
   /** Migration 063: codex reasoning_output_tokens (and similar) for reasoning models. */
   reasoningOutputTokens?: number;
-  /** Migration 063: claude extended-thinking tokens from CLI's `usage.thinking_input_tokens`. */
+  /**
+   * Migration 063: claude extended-thinking tokens from the result line's
+   * `usage.output_tokens_details.thinking_tokens`. Informational: they are a
+   * subset of `outputTokens` and already priced there.
+   */
   thinkingTokens?: number;
   /** Complete per-model usage, including sidechain/subagent tokens when available. */
   models?: CostModelUsage[];
@@ -263,7 +267,7 @@ export interface ProviderTraits {
    * agent never learns they exist. Defaults to true when omitted.
    */
   nativeSkillDiscovery?: boolean;
-  /** Provider runs in the local Docker container with /workspace, identity files, agent-fs, PM2, etc. */
+  /** Provider runs in the local Docker container with /workspace, identity files, agent-fs, etc. */
   hasLocalEnvironment: boolean;
   /** Live steering modes supported by this provider. Absent means none. */
   steerModes?: SteerMode[];

package/src/rbac/legacy-policy.ts

@@ -49,6 +49,13 @@ const operatorOrUser: LegacyRule = {
   evaluate: (principal) => principal.kind === "operator" || principal.kind === "user",
 };
 
+/** The shared API key only: swarm-wide settings that no session user or agent may change. */
+const operatorOnly: LegacyRule = {
+  name: "operator-only",
+  denyReason: "requires operator authentication",
+  evaluate: (principal) => principal.kind === "operator",
+};
+
 const leadOrOperatorOrUser: LegacyRule = {
   name: "lead-or-operator-or-user",
   denyReason: "requires lead agent, operator, or user authentication",
@@ -206,8 +213,9 @@ const memoryDelete: LegacyRule = {
 };
 
 /**
- * task.fs.mutate — operator OR user OR lead OR task-assignee OR task-creator
- * (src/http/fs.ts canMutateTask). Order-independent OR: today's early
+ * task.fs.mutate and task.parent.attach: operator OR user OR lead OR
+ * task-assignee OR task-creator (src/http/fs.ts canMutateTask; send-task and
+ * POST /api/tasks for a parentTaskId). Order-independent OR: today's early
  * operator/user returns short-circuit before agent identity, but no input
  * satisfies one branch while failing another, so a flat OR is equivalent
  * (plan Appendix A row 36 note).
@@ -276,6 +284,7 @@ export const LEGACY_POLICY = {
   "task.steer.own": requesterOwnsTask,
   "task.action.own": requesterOwnsTask,
   "task.fs.mutate": taskFsMutate,
+  "task.parent.attach": taskFsMutate,
   "task.progress.write": taskProgressWrite,
   "favorite.write.own": anyAuthenticated,
   "memory.learning.inject": leadOnly,
@@ -286,6 +295,10 @@ export const LEGACY_POLICY = {
   "channel.delete": leadOnly,
   "repo.merge-policy.write": leadOrOperatorOrUser,
   "integration.kapso.manage": leadOnly,
+  "integration.chat.manage": leadOnly,
+  "integration.chat.post": leadOnly,
+  "integration.chat.read": leadOnly,
+  "integration.chat.dm": leadOnly,
   "integration.slack.post": leadOnly,
   "integration.slack.read": leadOnly,
   "integration.slack.thread.start": leadOnly,
@@ -307,6 +320,7 @@ export const LEGACY_POLICY = {
   // Lead tokens retain config.read.secrets. This exception does not grant config administration.
   "models.catalog.write": leadOrOperator,
   "models.harness-support.write": agentOrOperator,
+  "models.profiles.write": operatorOnly,
   "skill.create.swarm": leadOnly,
   "skill.install.any": leadOnly,
   "skill.install.global": leadOnly,

package/src/rbac/permissions.ts

@@ -79,6 +79,11 @@ export const PERMISSIONS = {
     description: "Mutate a task's filesystem artifacts and attachments.",
     namespace: "task",
   },
+  "task.parent.attach": {
+    description:
+      "Create a task under an existing parent task. The child inherits the parent's thread context (contextKey, Slack thread, requester).",
+    namespace: "task",
+  },
   "task.progress.write": {
     description:
       "Write a task's progress, status, or output (its assignee, a lead, a human, or anyone while unassigned).",
@@ -124,6 +129,22 @@ export const PERMISSIONS = {
     description: "Register or unregister a Kapso inbound number.",
     namespace: "integration",
   },
+  "integration.chat.manage": {
+    description: "Register or unregister a Chat SDK channel route.",
+    namespace: "integration",
+  },
+  "integration.chat.post": {
+    description: "Post to a Chat SDK thread or channel other than the thread of the current task.",
+    namespace: "integration",
+  },
+  "integration.chat.read": {
+    description: "Read a Chat SDK thread other than the thread of the current task.",
+    namespace: "integration",
+  },
+  "integration.chat.dm": {
+    description: "Open a direct-message thread with a user on a Chat SDK adapter.",
+    namespace: "integration",
+  },
   "integration.slack.post": {
     description: "Post to a direct Slack channel.",
     namespace: "integration",
@@ -198,6 +219,11 @@ export const PERMISSIONS = {
       "Record whether a pinned harness CLI version accepts a model (a worker reports its own probe results; the operator may correct any row).",
     namespace: "models",
   },
+  "models.profiles.write": {
+    description:
+      "Create, update, or delete model profiles (named harness + model + effort). Operator (shared API key) only.",
+    namespace: "models",
+  },
   "config.read.secrets": {
     description: "Read unmasked secret config values.",
     namespace: "config",

package/src/scheduler/deferred-task-waits.ts

@@ -98,13 +98,12 @@ async function prepareDeferredWakeTask(
  */
 export const DEFERRED_WAIT_WOKE_EVENT = "task_deferred_wait_woke";
 
-/** Undefined means a normal schedule; an empty result means another caller won. */
-export async function dispatchDeferredTaskWait(
+/** Undefined means a normal schedule; an empty preparation means the wait is not ready. */
+export async function prepareDeferredTaskWait(
   scheduleId: string,
   reason: WakeReason,
   extraTags: string[] = [],
-  triggerTaskId?: string,
-): Promise<{ task?: AgentTask } | undefined> {
+): Promise<{ task?: PreparedTaskCreate } | undefined> {
   const client = getDbClient();
   // Keep ordinary schedule dispatch off the write-lock path.
   if (
@@ -117,8 +116,22 @@ export async function dispatchDeferredTaskWait(
   // first; the transaction below re-reads the wait and its member set before claiming.
   // The prepared description carries the cause seen here; for an `any` wait a member
   // that settles between this read and the claim is missing from that text only.
-  const preparedForWait = await prepareDeferredWakeTask(scheduleId, reason, extraTags);
+  return { task: await prepareDeferredWakeTask(scheduleId, reason, extraTags) };
+}
+
+/** Undefined means a normal schedule; an empty result means another caller won. */
+export async function dispatchDeferredTaskWait(
+  scheduleId: string,
+  reason: WakeReason,
+  extraTags: string[] = [],
+  triggerTaskId?: string,
+  prepared?: { task?: PreparedTaskCreate },
+): Promise<{ task?: AgentTask } | undefined> {
+  const preparation = prepared ?? (await prepareDeferredTaskWait(scheduleId, reason, extraTags));
+  if (!preparation) return undefined;
+  const preparedForWait = preparation.task;
   if (!preparedForWait) return {};
+  const client = getDbClient();
   return client.transaction(async () => {
     const resolved = await resolveWaitCause(scheduleId, reason);
     if (!resolved) return {};

package/src/scheduler/scheduler.ts

@@ -23,7 +23,7 @@ import {
   getScriptApiConnectionDescriptors,
   getScriptMcpConnectionDescriptors,
 } from "@/be/script-connections";
-import { buildScriptCredentialBindings } from "@/be/script-credential-broker";
+import { buildScriptCredentialBindingsWithFailures } from "@/be/script-credential-broker";
 import { getScript } from "@/be/scripts/db";
 import { runScript } from "@/scripts-runtime/loader";
 import { telemetry } from "@/telemetry";
@@ -38,6 +38,7 @@ import { scrubObject, scrubSecrets } from "../utils/secret-scrubber";
 import {
   dispatchDeferredTaskWait,
   initDeferredTaskWaits,
+  prepareDeferredTaskWait,
   reapSpentDeferredSchedules,
   reconcileDeferredTaskWaits,
   stopDeferredTaskWaits,
@@ -99,12 +100,14 @@ async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
 
   let output: Awaited<ReturnType<typeof runScript>>;
   try {
+    const credentials = await buildScriptCredentialBindingsWithFailures({ agentId });
     output = await runScript({
       source: script.source,
       args,
       fsMode: "none",
       agentId,
-      egressSecrets: await buildScriptCredentialBindings({ agentId }),
+      egressSecrets: credentials.egressSecrets,
+      userConfig: credentials.userConfig,
       apiConnections: getScriptApiConnectionDescriptors({ agentId }),
       mcpConnections: getScriptMcpConnectionDescriptors({ agentId }),
       timeoutMs: 60_000,
@@ -301,6 +304,9 @@ async function throwIfWorkflowNeedsSetup(scheduleId: string, runIds: string[]):
  * recovery pass, or schedule edit invalidates it before any target is dispatched.
  */
 async function claimScheduleOccurrence(snapshot: ScheduledTask, extraTags: string[]) {
+  // Run extension pre-hooks before opening the claim transaction. The snapshot
+  // guard below still prevents a moved ceiling from consuming this preparation.
+  const preparedWait = await prepareDeferredTaskWait(snapshot.id, "ceiling", extraTags);
   return getDbClient().transaction(async () => {
     const current = await getScheduledTaskById(snapshot.id);
     if (!current?.enabled || !current.nextRunAt || current.nextRunAt !== snapshot.nextRunAt) {
@@ -311,7 +317,9 @@ async function claimScheduleOccurrence(snapshot: ScheduledTask, extraTags: strin
     // Event-driven waits already atomically create their child and consume the
     // ceiling. Keep that transaction (and its afterCommit emits) intact: disabling
     // a one-time schedule first would prevent its wake-up task from being created.
-    const deferred = await dispatchDeferredTaskWait(schedule.id, "ceiling", extraTags);
+    const deferred = preparedWait
+      ? await dispatchDeferredTaskWait(schedule.id, "ceiling", extraTags, undefined, preparedWait)
+      : undefined;
     if (deferred) {
       return {
         schedule,

package/src/scripts-runtime/executors/quickjs-prelude.ts

@@ -5,11 +5,14 @@
  *
  *  - `__host_call(path, argsJson)`: async host call, resolves to a JSON envelope.
  *  - `__host_sync(op, json)`: sync host call, returns a JSON envelope.
+ *    `crypto.random` returns that many random bytes.
  *  - `__host_log(stream, text)`: append to the captured stdout or stderr.
  *  - `__host_sleep(ms)`: resolves after `ms` on the host clock.
  *  - `__host_done(json)`: reports the final outcome of the run.
  *
  * Every value crosses the boundary as JSON. The sandbox has no other way out.
+ * `SANDBOX_WEB_SHIMS` (quickjs-web-shims.ts) runs first and adds URL,
+ * URLSearchParams, TextEncoder and TextDecoder.
  * `__swarm_shape` (injected before this file) lists the configured api/mcp
  * connections so `ctx.api.<slug>` matches the native executor exactly.
  */
@@ -64,6 +67,39 @@ const setTimeout = (fn, ms, ...args) => {
 const clearTimeout = (id) => {
   timers.delete(id);
 };
+// Shares the timer ids with setTimeout, so either clear function stops either.
+const setInterval = (fn, ms, ...args) => {
+  const id = ++timerSeq;
+  const delay = Math.max(1, Number(ms) || 0);
+  timers.add(id);
+  const tick = () =>
+    __host_sleep(delay).then(() => {
+      if (!timers.has(id)) return;
+      tick();
+      fn(...args);
+    });
+  tick();
+  return id;
+};
+const clearInterval = clearTimeout;
+
+// ── crypto (bytes come from the host CSPRNG) ──
+const INTEGER_ARRAYS = [Int8Array, Uint8Array, Uint8ClampedArray, Int16Array, Uint16Array, Int32Array, Uint32Array, BigInt64Array, BigUint64Array];
+const getRandomValues = (array) => {
+  if (!INTEGER_ARRAYS.some((type) => array instanceof type)) {
+    throw new TypeError("crypto.getRandomValues: the argument must be an integer TypedArray");
+  }
+  new Uint8Array(array.buffer, array.byteOffset, array.byteLength).set(hostSync("crypto.random", array.byteLength));
+  return array;
+};
+const randomUUID = () => {
+  const bytes = hostSync("crypto.random", 16);
+  bytes[6] = (bytes[6] & 0x0f) | 0x40;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+  const hex = bytes.map((b) => (b + 256).toString(16).slice(1)).join("");
+  return hex.slice(0, 8) + "-" + hex.slice(8, 12) + "-" + hex.slice(12, 16) + "-" + hex.slice(16, 20) + "-" + hex.slice(20);
+};
+const crypto = Object.freeze({ getRandomValues, randomUUID });
 
 // ── Redacted ──
 const redactedEntries = new WeakMap();
@@ -115,7 +151,7 @@ const config = Object.freeze({
   },
 });
 
-// ── fetch (text bodies only) ──
+// ── fetch ──
 class Headers {
   constructor(init) {
     this._map = new Map();
@@ -165,14 +201,44 @@ class Response {
     return JSON.parse(this._body);
   }
 }
+const BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const toBase64 = (bytes) => {
+  let out = "";
+  let i = 0;
+  for (; i + 2 < bytes.length; i += 3) {
+    const n = (bytes[i] << 16) | (bytes[i + 1] << 8) | bytes[i + 2];
+    out += BASE64[n >> 18] + BASE64[(n >> 12) & 63] + BASE64[(n >> 6) & 63] + BASE64[n & 63];
+  }
+  if (i < bytes.length) {
+    const n = (bytes[i] << 16) | ((bytes[i + 1] || 0) << 8);
+    out += BASE64[n >> 18] + BASE64[(n >> 12) & 63] + (i + 1 < bytes.length ? BASE64[(n >> 6) & 63] : "=") + "=";
+  }
+  return out;
+};
+// Binary bodies cross the host boundary as base64; the host decodes them.
+const encodeBody = (body, headers) => {
+  if (body == null) return {};
+  if (typeof body === "string") return { body };
+  if (body instanceof globalThis.URLSearchParams) {
+    if (!headers.has("content-type")) headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+    return { body: body.toString() };
+  }
+  if (body instanceof ArrayBuffer) return { bodyBase64: toBase64(new Uint8Array(body)) };
+  if (ArrayBuffer.isView(body)) {
+    return { bodyBase64: toBase64(new Uint8Array(body.buffer, body.byteOffset, body.byteLength)) };
+  }
+  throw new TypeError(
+    "quickjs executor: fetch body must be a string, Uint8Array, ArrayBuffer or URLSearchParams (JSON.stringify objects first)",
+  );
+};
 const toRequest = (input, init) => {
   const options = init || {};
   const url = typeof input === "string" ? input : input && (input.href || input.url) ? input.href || input.url : String(input);
-  if (options.body != null && typeof options.body !== "string") {
-    throw new TypeError("quickjs executor: fetch body must be a string (JSON.stringify it first)");
-  }
-  const headers = options.headers == null ? undefined : Array.from(new Headers(options.headers).entries());
-  const request = { url, method: options.method, headers, body: options.body == null ? undefined : options.body };
+  const headerMap = new Headers(options.headers);
+  const body = encodeBody(options.body, headerMap);
+  const headerList = Array.from(headerMap.entries());
+  const headers = options.headers == null && headerList.length === 0 ? undefined : headerList;
+  const request = { url, method: options.method, headers, ...body };
   if (options.retries !== undefined) request.retries = options.retries;
   if (options.timeoutMs !== undefined) request.timeoutMs = options.timeoutMs;
   return request;
@@ -223,6 +289,9 @@ const define = (name, value) =>
 define("console", console);
 define("setTimeout", setTimeout);
 define("clearTimeout", clearTimeout);
+define("setInterval", setInterval);
+define("clearInterval", clearInterval);
+define("crypto", crypto);
 define("fetch", fetch);
 define("Headers", Headers);
 define("Response", Response);

package/src/scripts-runtime/executors/quickjs-runner.ts

@@ -13,6 +13,7 @@ import { table } from "../stdlib/table";
 import { SwarmConfig } from "../swarm-config";
 import { bundleForQuickJS, USER_SCRIPT_FILE } from "./quickjs-bundle";
 import { SANDBOX_EPILOGUE, SANDBOX_PRELUDE } from "./quickjs-prelude";
+import { SANDBOX_WEB_SHIMS } from "./quickjs-web-shims";
 import type { SourceMapReader } from "./sourcemap";
 import type {
   ExecutorOutput,
@@ -37,6 +38,13 @@ const BUNDLE_FILE = USER_SCRIPT_FILE.replace(/\.ts$/, ".js");
 const MAX_CONCURRENT_HOST_CALLS = 16;
 // Host calls and timers that one run can have in flight or queued.
 const MAX_PENDING_HOST_CALLS = 1024;
+// A binary fetch body crosses the bridge as base64 and is decoded on the host.
+// One body decodes to at most this many bytes, and the binary bodies a run has
+// queued or in flight total at most MAX_PENDING_BINARY_BODY_BYTES. Both are
+// checked before decoding, so a rejected request never reaches fetch.
+const MAX_BINARY_BODY_BYTES = 16 * 1024 * 1024;
+const MAX_BINARY_BODY_BASE64_LENGTH = Math.ceil(MAX_BINARY_BODY_BYTES / 3) * 4;
+const MAX_PENDING_BINARY_BODY_BYTES = 64 * 1024 * 1024;
 // After a run ends, its host calls are aborted. Wait this long for them to settle.
 const HOST_CALL_SETTLE_MS = 1_000;
 
@@ -46,6 +54,9 @@ export type QuickJSJobResult = {
   leakedHostCalls: number;
 };
 const MAX_STACK_BYTES = 1024 * 1024;
+// Bun's getRandomValues has no 64 KiB quota, so neither does the sandbox. This
+// bound only keeps one sync host call's JSON reply small.
+const MAX_RANDOM_BYTES = 1024 * 1024;
 const TIMEOUT_EXIT_CODE = 124;
 
 type ErrorPayload = { name: string; message: string; stack: string };
@@ -126,12 +137,51 @@ type SandboxRequest = {
   method?: string;
   headers?: [string, string][];
   body?: string;
+  /** Binary body, base64-encoded by the sandbox. */
+  bodyBase64?: string;
   retries?: number;
   timeoutMs?: number;
 };
 
+const FETCH_PATHS = new Set(["fetch", "stdlib.fetch", "stdlib.fetchJson"]);
+const BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+
+/**
+ * Checks a sandbox fetch request's base64 body without decoding it and returns
+ * its decoded size (0 when there is none). The sandbox controls the value, so
+ * the type, alphabet and size are checked before the host allocates anything.
+ */
+function binaryBodySize(request: unknown): number {
+  if (!request || typeof request !== "object") return 0;
+  const encoded = (request as { bodyBase64?: unknown }).bodyBase64;
+  if (encoded === undefined) return 0;
+  if (typeof encoded !== "string") throw new TypeError("fetch bodyBase64 must be a string");
+  if (encoded.length > MAX_BINARY_BODY_BASE64_LENGTH) {
+    throw new RangeError(
+      `fetch binary body exceeds the ${MAX_BINARY_BODY_BYTES}-byte limit of the quickjs executor`,
+    );
+  }
+  if (encoded.length % 4 !== 0 || !BASE64_RE.test(encoded)) {
+    throw new TypeError("fetch bodyBase64 is not valid base64");
+  }
+  const padding = encoded.endsWith("==") ? 2 : encoded.endsWith("=") ? 1 : 0;
+  const size = (encoded.length / 4) * 3 - padding;
+  if (size > MAX_BINARY_BODY_BYTES) {
+    throw new RangeError(
+      `fetch binary body exceeds the ${MAX_BINARY_BODY_BYTES}-byte limit of the quickjs executor`,
+    );
+  }
+  return size;
+}
+
 function requestInit(request: SandboxRequest): RequestInit {
-  return { method: request.method, headers: request.headers, body: request.body };
+  if (request.bodyBase64 === undefined) {
+    return { method: request.method, headers: request.headers, body: request.body };
+  }
+  // Already checked by binaryBodySize when the call was accepted.
+  const bytes = Buffer.from(request.bodyBase64, "base64");
+  const body = new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  return { method: request.method, headers: request.headers, body };
 }
 
 async function serializeResponse(response: Response, operation: string) {
@@ -223,6 +273,16 @@ function dispatchSync(config: SwarmConfig, op: string, value: unknown): unknown
       return Redacted.meta(redactedFor(config, value));
     case "config.has":
       return typeof value === "string" && config.get(value) !== undefined;
+    case "crypto.random": {
+      if (
+        !Number.isInteger(value) ||
+        (value as number) < 0 ||
+        (value as number) > MAX_RANDOM_BYTES
+      ) {
+        throw new Error(`crypto.random needs a byte count between 0 and ${MAX_RANDOM_BYTES}`);
+      }
+      return Array.from(crypto.getRandomValues(new Uint8Array(value as number)));
+    }
     case "table":
       return table(value as Array<Record<string, unknown>>);
     default:
@@ -287,6 +347,7 @@ class HostCallScope {
   private readonly waiters: Array<() => void> = [];
   private readonly outerFetch = globalThis.fetch;
   private active = 0;
+  private bodyBytes = 0;
 
   constructor() {
     const outer = this.outerFetch;
@@ -306,8 +367,11 @@ class HostCallScope {
     return this.controller.signal;
   }
 
-  /** Track a host call. `limited` calls share the per-run concurrency budget. */
-  call<T>(run: () => Promise<T>, limited: boolean): Promise<T> {
+  /**
+   * Track a host call. `limited` calls share the per-run concurrency budget.
+   * `bodyBytes` counts against the per-run binary body budget until it settles.
+   */
+  call<T>(run: () => Promise<T>, limited: boolean, bodyBytes = 0): Promise<T> {
     if (this.ops.size >= MAX_PENDING_HOST_CALLS) {
       return Promise.reject(
         new Error(
@@ -315,12 +379,21 @@ class HostCallScope {
         ),
       );
     }
+    if (this.bodyBytes + bodyBytes > MAX_PENDING_BINARY_BODY_BYTES) {
+      return Promise.reject(
+        new RangeError(
+          `Pending fetch binary bodies in one script run exceed ${MAX_PENDING_BINARY_BODY_BYTES} bytes`,
+        ),
+      );
+    }
+    this.bodyBytes += bodyBytes;
     const op = limited ? this.limited(run) : run();
     this.ops.add(op);
-    void op.then(
-      () => this.ops.delete(op),
-      () => this.ops.delete(op),
-    );
+    const settle = () => {
+      this.ops.delete(op);
+      this.bodyBytes -= bodyBytes;
+    };
+    void op.then(settle, settle);
     return op;
   }
 
@@ -491,7 +564,10 @@ async function evaluateJob(
   define("__host_call", (pathHandle, argsHandle) => {
     const path = ctx.getString(pathHandle);
     const callArgs = JSON.parse(ctx.getString(argsHandle)) as unknown[];
-    return bridge(() => host.call(() => dispatchCall(hostCtx, path, callArgs, host.signal), true));
+    return bridge(async () => {
+      const bodyBytes = FETCH_PATHS.has(path) ? binaryBodySize(callArgs?.[0]) : 0;
+      return host.call(() => dispatchCall(hostCtx, path, callArgs, host.signal), true, bodyBytes);
+    });
   });
   define("__host_sync", (opHandle, valueHandle) => {
     let envelope: unknown;
@@ -538,6 +614,7 @@ async function evaluateJob(
     const init = `globalThis.__swarm_shape = ${JSON.stringify(shape)};\nglobalThis.__swarm_args = ${JSON.stringify(args)};`;
     const ok =
       evaluate(init, "swarm-init.js") &&
+      evaluate(SANDBOX_WEB_SHIMS, "swarm-web-shims.js") &&
       evaluate(SANDBOX_PRELUDE, "swarm-prelude.js") &&
       evaluate(bundle.code, BUNDLE_FILE) &&
       evaluate(SANDBOX_EPILOGUE, "swarm-epilogue.js");